Add processContainer.captureDenials config for Windows denial capture

[richiemsft]

• I have signed the Contributor License Agreement.
• This pull request is related to an issue.
• If this PR changes build commands, project architecture, or key conventions, I have updated .github/copilot-instructions.md.

---

Summary

Adds a captureDenials object under processContainer that will enable the
Windows learning-mode trace. This is the config-contract half of the
learning-mode denial-capture feature — pure plumbing, no runtime behavior yet.

Shape — processContainer.captureDenials: { mode?: "block-and-log" | "allow-and-log", outputPath?: string }:

• Presence of the object enables capture.
• mode (optional) selects how each ungranted access check is handled while it
  is recorded. Both modes log every access the policy does not grant; the mode
  only decides whether that access is blocked or allowed:
  • block-and-log (default) — the access stays denied and the denial
    is recorded. Deny-by-default containment is preserved; the safe default.
  • allow-and-log — the access is allowed and recorded (audit mode). This
    relaxes deny-by-default for the run, so it is security-sensitive and the
    runner emits a security warning.
  • Omitting mode defaults to block-and-log. An unknown value is rejected at
    parse time with an error naming both valid modes.
• outputPath (optional) names where the ETL trace is sealed. The OS model is
  caller-controlled (StopLearningModeTrace(trace, lpOutputPath)), so the
  caller names the path; it is opened under the caller''s own identity. When
  omitted, the runner will fall back to a managed per-run temp file.
• The path is validated at parse time (must be absolute with an existing parent
  directory) with actionable errors.

What''s in scope (this PR):

• Wire model (wire::CaptureDenials + wire::CaptureDenialsMode on wire::ProcessContainer).
• Domain model (CaptureDenialsConfig + CaptureDenialsMode on ContainerPolicy.capture_denials).
• Parser mapping + validation in config_parser.rs.
• Regenerated dev schema (schemas/dev/mxc-config.schema.0.8.0-dev.json) and SDK
  wire types (sdk/node/src/generated/wire.ts) via mxc_schema_gen (codegen —
  not hand-edited).
• Docs (docs/schema.md) + example (tests/examples/29_capture_denials.json).
• Unit tests (parse/validate/mode) + all schema/version/codegen gates green.

What''s intentionally NOT here (follow-up integration PR):

• Auto-injection of the learningModeLogging capability when captureDenials
  is set — that reuses the capability recognition from the capabilities PR.
• The runner trace lifecycle (Start -> run -> Stop -> write ETL) and the
  block-vs-allow enforcement behind each mode — that consumes the
  learning-mode OS API.

Both land in the integration PR stacked on top of the capabilities + consume-API
PRs plus this one.

Related Issues

• Inject and validate the two learning-mode capabilities #622 (learning-mode capabilities — provides learningModeLogging recognition)
• Consume the Windows Learning Mode trace API: FFI loader + capture lifecycle #661 (consume the learning-mode OS API — the capture engine)

Validation

• cargo test -p wxc_common — 466 pass (9 captureDenials tests, incl. 4 mode tests)
• cargo fmt --all -- --check, cargo clippy -p wxc_common --all-targets -- -D warnings
• cargo check --workspace --all-targets
• npm run test:unit (SDK) — 201 pass
• node scripts/versioning/{validate-configs,check-schema-codegen,check-sdk-types-codegen,check-schema-versions}.js

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Adds the config-contract plumbing for Windows denial capture (“learning-mode” deny-and-record trace) by introducing a new processContainer.captureDenials object that maps from wire → domain model, validates outputPath, and updates schema/docs/examples accordingly.

Changes:

• Extend the Rust wire model with processContainer.captureDenials: { outputPath?: string } and propagate it into the domain policy model.
• Add parse-time validation + mapping for captureDenials.outputPath in config_parser.rs, with unit tests.
• Regenerate the dev JSON schema + Node SDK generated wire types, and update docs + an example config.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/examples/29_capture_denials.json	New example configuration demonstrating processContainer.captureDenials.
src/core/wxc_common/src/wire.rs	Adds CaptureDenials wire struct and hooks it into ProcessContainer.
src/core/wxc_common/src/models.rs	Adds ContainerPolicy.capture_denials: Option<CaptureDenialsConfig> domain field.
src/core/wxc_common/src/config_parser.rs	Maps + validates captureDenials (including outputPath) and adds unit tests.
sdk/node/src/generated/wire.ts	Codegen update reflecting the new wire schema types.
schemas/dev/mxc-config.schema.0.8.0-dev.json	Codegen update adding the CaptureDenials definition and field.
docs/schema.md	Updates the schema documentation snippet to include captureDenials.

[richiemsft]

/azp run

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).